T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/word_demo.py:178- Finding
Unsaved Document Content Can Be Deleted Without Verifying That the Document Is Blank
- Content
View full analysis
0: for i in range(1, word.Documents.Count + 1): doc = word.Documents.Item(i) if not doc.Saved: print(f'[文档] 复用已有文档: {doc.Name}') # 清除内容，准备写入新内容 try: doc.Content.Delete() except: pass return doc except: pass return word.Documents.Add() ``` ### Technical Analysis The function is documented as reusing an unsaved **blank** document, but the only eligibility check is `not doc.Saved`. An unsaved document is not necessarily empty: it may contain newly created or modified user content. Once such a document is selected, `doc.Content.Delete()` removes its entire contents without verifying that the document is blank and without requesting user confirmation. Broad exception handlers suppress errors, making destructive or partially failed operations less visible. The script uses `DispatchEx("Word.Application")`, which normally creates a separate Word instance and reduces exposure to documents in an existing user-controlled Word instance. However, the helper does not enforce that assumption. If the automation instance contains a non-empty unsaved document, the deletion still occurs. ### Attack Path 1. A non-empty unsaved document becomes available through the Word COM instance used by the script. 2. `get_or_create_doc()` enumerates the documents in that instance. 3. The function treats the document as reusable solely because `doc.Saved` is false. 4. `doc.Content.Delete()` deletes all existing document content. 5. The typewriter process writes generated ...[truncated 684 chars]- Remediation
View remediation